Critical Malicious Code Vulnerability in ve-bamreader Package
Summary
MAL-2025-47358: Malicious code in ve-bamreader (npm). Affects ve-bamreader versions >= 0.2.6, <= 0.2.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ve-bamreader package is an npm library designed for reading BAM files, commonly used in bioinformatics for storing sequence data. It provides functionalities to manipulate and analyze genomic data efficiently. However, the package has been compromised, leading to the introduction of malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability stems from the compromise of the ve-bamreader package, where malicious code was embedded within versions 0.2.6 and 0.2.7. This malicious payload is associated with the Shai-Hulud NPM worm, which is designed to steal tokens and credentials from the user's environment. Once compromised, the malware can publish sensitive information to GitHub and propagate itself to other NPM packages owned by the user, leading to potential data breaches and unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ve-bamreaderIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the ve-bamreader package until it has been confirmed safe. Additionally, consider using alternative libraries for BAM file processing that do not have known vulnerabilities.
Conclusion
The ve-bamreader package has been compromised, leading to a critical vulnerability that can expose users to significant security risks. It is essential to remove the affected versions and monitor for any signs of compromise. Utilizing tools like Vulert can help ensure your applications remain secure against such vulnerabilities.
See every vulnerability recorded for ve-bamreader →
FAQ
Versions 0.2.6 and 0.2.7 of the ve-bamreader package are affected by this vulnerability.
Immediately remove the affected package and rotate any secrets or keys stored on the compromised system.
The malicious code can steal sensitive tokens and credentials, potentially leading to unauthorized access to your accounts and data.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The Shai-Hulud NPM worm is a type of malware that targets NPM packages, stealing credentials and propagating itself to other packages owned by the user.
